PT-2021-14677 · Jenkins · Jenkins Jabber (Xmpp) Notifier/Control Plugin+1

Daniel Beck · Published 2021-03-30 · Updated 2023-10-25 · CVE-2021-21634

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Jabber (XMPP) notifier and control Plugin versions 1.41 and earlier

Description The issue concerns the storage of passwords in the global configuration file on the Jenkins controller. Specifically, passwords are stored unencrypted in the file hudson.plugins.jabber.im.transport.JabberPublisher.xml, allowing users with access to the Jenkins controller file system to view them.

Recommendations For Jenkins Jabber (XMPP) notifier and control Plugin versions 1.41 and earlier, update to version 1.42 or later, as version 1.42 stores passwords encrypted once its configuration is saved again.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-21634

GHSA-79R5-RHRW-7PVH

Affected Products

Jenkins

Jenkins Jabber (Xmpp) Notifier/Control Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2021-21634 · Vendor Advisory
• https://jenkins.io/security/advisory/2021-03-30/#SECURITY-2162 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-79r5-rhrw-7pvh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21634 · Security Note
• https://github.com/jenkinsci/jabber-plugin · Note
• https://github.com/jenkinsci/jabber-plugin/commit/67882cfd189d6d05ad39e043edbfbf079dc37677 · Note
• https://t.me/cvenotify/12315 · Telegram Post
• http://openwall.com/lists/oss-security/2021/03/30/1 · Note
• https://t.me/cvenotify/12529 · Telegram Post